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CLAIM AMENDMENTS 

1 . (Original) A method of tracing data traffic on a network, the method comprising: 
at the transport layer of a protocol stack residing on a first device in the network, 

detecting a transmission or receipt of data to or from a second device on the network; and in 
response to the transmission or receipt being detected, recording the transmission or receipt as an 
entry in a trace log, wherein the trace log is accessible to determine the volume of data traveling 
over a network. 

2. (Original) The method of claim 1, wherein the protocol stack is a TCP/IP stack. 

3. (Original) The method of claim 1, wherein the detection step further comprises the 
step of detecting the presence of an input/output packet representing the transmission or receipt. 

4. (Previously Presented) A method of tracing a transmission of data over a computer 
network comprising: detecting a transport-layer request to transmit an input/output packet; 
searching the input/output packet to determine an identity of a process that created the input/output 
packet; and storing in a trace log an entry representing the request, wherein the entry comprises the 
identity of the process, and wherein the trace log is accessible to determine a volume of data being 
transmitted over the network. 

5. (Original) The method of claim 4, further comprising: detecting an acknowledgment 
of the transmission; and in response to the detection of the acknowledgment, storing in the trace 
log an entry representing the completion of the transmission. 

6. (Previously Presented) A method of tracing a receipt of data from a computer 
network comprising: detecting a transport-layer request to transmit a packet for an input/output 
connection to a port; searching the packet to determine an identity of a process that created the 
packet; and in response to the detection of a receipt of data at the port, storing in a trace log an entry 
representing the receipt of the data, wherein the entry comprises the process identification, and 
wherein the trace log is accessible to determine a volume of the data being transmitted over the 
network. 
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7. (Original) The method of claim 6, further comprising: creating a connection object 
representing the opening of the port connection by the process; copying the process identification 
from the connection object into a transport control block associated with the port; and in 
response to the detection of the receipt of data at the port, copying the process identification into 
the trace log. 

8. (Original) The method of claim 7, further comprising: copying the process 
identification from the connection object into the transport control block so that the process 
identification is contiguous with the rest of the data in the transport control block. 

9. (Currently Amended) The method of claim 8, further comprising: detecting the 
presence of an input/output request packet indicating that the data receipt is complete; and in 
response to the detection of the completion input/ouput input/output request packet, making an 
entry representing the receipt of the data into a trace log. 

10. (Previously Presented) A facility for tracing data traffic on a network, the facility 
comprising: an identifying means for identifying a process causing a transport-layer request to 
transmit data via the network; and a logging means in communication with the identifying means 
for logging and event, wherein the event comprises the identification the process and wherein the 
logging means is useable to determine a volume of data traveling over the network. 

11. (Original) The apparatus of claim 10 wherein the identifying means further 
comprises means for communicating with a transport layer of a protocol stack. 

12. (Original) A computer-readable medium having stored thereon computer-executable 
instructions for performing steps comprising: at the transport layer of a protocol stack residing 
on a first device in the network, detecting a transmission or receipt of data to or from a second 
device on the network; and in response to the transmission or receipt being detected, recording 
the transmission or receipt as an entry in a trace log, wherein the trace log is accessible to 
determine the volume of data traveling over a network. 

13. (Original) The computer-readable medium of claim 12, wherein the protocol stack is 
a TCP/IP stack. 
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14. (Original) The computer-readable medium of claim 12, having further computer- 
executable instructions for performing the step of detecting the presence of an input/output 
packet representing the transmission or receipt. 

15. (Previously Presented) A computer-readable medium having stored thereon 
computer-executable instructions for performing steps comprising: detecting a transport-layer 
request to transmit an input/output packet; searching the input/output packet to determine an identity 
of a process that created the input/output packet; and storing in a trace log an entry representing the 
request, wherein the entry comprises the identity of the process, and wherein the trace log is 
accessible to determine a volume of data being transmitted over the network. 

16. (Original) The computer-readable medium of claim 15, having further computer- 
executable instructions for performing the step of detecting the presence of the input/output 
packet at the transport layer of a protocol stack. 

17. (Original) The computer-readable medium of claim 15, having further computer- 
executable instructions for performing the step of detecting an acknowledgment of the 
transmission; and in response to the detection of the acknowledgment, storing in the trace log an 
entry representing the completion of the transmission. 

1 8. (Previously Presented) A computer-readable medium having stored thereon 
computer-executable instructions for performing the steps comprising: detecting a transport- 
layer request to transmit a packet for an input-output connection to a port; searching the packet to 
determine an identity of a process that created the packet; and in response to the detection of a 
receipt of data at the port, storing in a trace log an entry representing the receipt of the data, 
wherein the entry comprises the process identification, and wherein the trace log is accessible to 
determine the volume of the data being transmitted over the network. 

19. (Original) The computer-readable medium of claim 18, having further computer- 
executable instructions for performing the steps of: creating a connection object representing the 
opening of the port connection by the process; copying the process identification from the 
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connection object into a transport control block associated with the port; and in response to the 
detection of the receipt of data at the port, copying the process identification into the trace log. 

20. (Original) The computer-readable medium of claim 18, having further computer- 
executable instructions for performing the step of copying the process identification from the 
connection object into the transport control block so that the process identification is contiguous 
with the rest of the data in the transport control block. 

21. (Original) The computer-readable medium of claim 18, having further computer- 
executable instructions for performing the steps of: detecting the presence of an input/output 
request packet indicating that the data receipt is complete; and in response to the detection of the 
completion input/output request packet, storing in the trace log an entry representing the receipt 
of the data. 

22. (Previously Presented) The method of claim 1, wherein the transmission of data is 
recorded at the completion of the transmission indicated by an acknowledgement from the first 
device. 

23. (Canceled) 

24. (Previously Presented) The method of claim 4, wherein the identity of the process 
includes a port number or an IP address relating to the transmission. 
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